Hi @fedayn05, Which versions of Splunk Enterprise and Splunk Enterprise Security do you have installed? Splunk Enterprise 9.0.1 deprecates and Splunk Enterprise 10.0 disables the REST API search/parser endpoint used by earlier versions of Splunk Enterprise Security to validate the data models used by the threatmatch modular input. If you're running Splunk Enterprise 10.0, ensure you're also running Splunk Enterprise Security 7.3.4 or a later version of Splunk Enterprise Security compatible with Splunk Enterprise 10.0 and the v2 REST API.
... View more